fc20b03299b8ae91e72e104ee4f18e40125b2b061f1509d1c5b3f9fac3104934

General

Target
fc20b03299b8ae91e72e104ee4f18e40125b2b061f1509d1c5b3f9fac3104934
Size 329KB
Sample240422-vebzwsdf32
SHA256 fc20b03299b8ae91e72e104ee4f18e40125b2b061f1509d1c5b3f9fac3104934
MD5 5fc6f24d43bc7ca45a81d159291955d1
SHA1 72fc3ce96bd9406215cec015d70bbb67318f1e23
SHA512 b39488cfaec3bbe93fc4b22f92edfc3b2b729e6f75a472d722418b259fc9c74faae60f5126384dc242ba1b42300e60428c7c530982550625cd59e1684f7c9380
SSDEEP 6144:8OZsdXcUIAoUKjiXeZtna8UtDpiyeMTHSN+5qm:8OZQXcDkLuTa8UtteCHP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc20b03299b8ae91e72e104ee4f18e40125b2b061f1509d1c5b3f9fac3104934

File Explorer

fc20b03299b8ae91e72e104ee4f18e40125b2b061f1509d1c5b3f9fac3104934

.exe 329KB

fc20b03299b8ae91e72e104ee4f18e40125b2b061f1509d1c5b3f9fac3104934

IMPHASH 96d0079f67bae2a84dc8552c3ab1d176
SHA256 fc20b03299b8ae91e72e104ee4f18e40125b2b061f1509d1c5b3f9fac3104934
MD5 5fc6f24d43bc7ca45a81d159291955d1
SHA1 72fc3ce96bd9406215cec015d70bbb67318f1e23
SHA512 b39488cfaec3bbe93fc4b22f92edfc3b2b729e6f75a472d722418b259fc9c74faae60f5126384dc242ba1b42300e60428c7c530982550625cd59e1684f7c9380
SSDEEP 6144:8OZsdXcUIAoUKjiXeZtna8UtDpiyeMTHSN+5qm:8OZQXcDkLuTa8UtteCHP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

28269

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\rev xag98.pdb

kernel32

GetProcAddress LocalAlloc VirtualProtect GetLongPathNameW ExitThread GetTickCount lstrcpyA lstrcpyW GetModuleHandleA ExpandEnvironmentStringsA WritePrivateProfileStructA CreateFileA MoveFileW VerifyVersionInfoW EnumSystemLocalesA FillConsoleOutputCharacterA EncodePointer DecodePointer RaiseException RtlUnwind GetCommandLineW IsProcessorFeaturePresent GetLastError HeapAlloc HeapFree ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte HeapSize IsDebuggerPresent EnterCriticalSection LeaveCriticalSection GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW SetLastError GetCurrentThread GetCurrentThreadId GetProcessHeap GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW CreateSemaphoreW SetConsoleCtrlHandler GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FatalAppExitA FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapReAlloc OutputDebugStringW GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile ReadConsoleW CloseHandle SetStdHandle SetFilePointerEx WriteConsoleW CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

fc20b03299b8ae91e72e104ee4f18e40125b2b061f1509d1c5b3f9fac3104934

kernel32

generic